Where find account with leaked password

Question

Hi
we setup password has sync and all about azure ad assword protection in audit mode.

Now where i find account with leaked password?

When i try chenge password do som leaked pass like asdf123456789, in evenlog i see password would normally have been rejected but in audit mode its ok.

So now i need somewhere view all users with leaked password.
Where to find this info?

Answer 1

There is no list of users with leaked passwords.
However if you licensed and using Identity Protection, you can access the User Risk menu and view accounts that triggered that risk:

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#user-linked-detections

Answer 2

Hi
we have identity protection, user have AAD Premium 2 assigned.
But when I check our test user with leaked password there is no risk.

Answer 3

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#why-arent-i-seeing-any-leaked-credentials

Its not going to happen immediately.

Answer 4

Sorry but i dont understand.

We have account on onprem AD.
I change password to leaked password. In eventlog i see it was detected and dont be blocked cause its on audit mode.
Where i see this on azure? Account have 100% leaked pasword why azure dont show this?